In today’s blog, we’re going to discuss what can go wrong during a web application penetration test and some strategies that can help you and your testing team avoid running into these issues. Any type of penetration test is an exercise in identifying and exploiting vulnerabilities in a target, just like an attacker would. In […]
There are a number of different names people use when referring to an onsite assessment they are required to undergo as a part of their Payment Card Industry (PCI) compliance. A Level 1 assessment, a PCI QSA onsite assessment, a ROC assessment. All of these are referring to the same thing: a PCI Onsite Assessment […]
Threat modeling is a term thrown around in a lot of different contexts, but it can sound daunting if your unfamiliar with it in practice. It really just refers to identifying what threats an organization, a target network, or an in-scope application should be worried about. For penetration testers, you are modeling (mapping out) the […]
As we continue our series explaining some of the most common web application vulnerabilities we encounter during penetration tests, we arrive at cross-site scripting (XSS). XSS comes in at number 7 on the most recent OWASP Top 10 release, so it is still an issue for a significant number of applications and organizations. Caused by […]
As we continue our mini-series addressing some of the most common web application vulnerabilities we see during assessments, we turn our attention to the broad category of authentication weaknesses next. The OWASP Top 10 identifies this category as number 2 on its list, meaning it is obviously well known and prevalent. So then why are […]
As we continue to try and share knowledge we’ve gained in our time performing penetration testing, we’re going to focus on another common web application vulnerability I keep running into. Authorization bypass is number 5 on the OWASP Top 10, further demonstrating that this continues to be a common issue plaguing web applications. The biggest […]
Throughout our assessments, we get the opportunity to work with a wide variety of clients and see a ton of different web applications. When performing web application penetration testing in particular, there are a number of issues that we notice over and over again, regardless of the development language, application architecture, etc. If we see […]
With the rise of the Internet of Things (IoT) and Internet-connected devices becoming more pervasive in every organization, it makes sense that there’s been more done to assess the risk and implement security controls for these devices. Both the organizations that produce IoT devices and the organizations that incorporate them into their networks have responsibilities […]
Shadow IT is a somewhat recent and fancy term that has been given to any software, hardware, or technology in general that is used within an organization outside the purview of the IT department. Anything that isn’t sanctioned and centrally controlled by the organization’s IT department or that they don’t know exists would fall into […]
Such a simple question, but it has many different answers, all of which can be important to your understanding of web application security. The Open Web Application Security Project (OWASP) is a non-profit organization with a simple mission: Improving the Security of Software. The organization is open to anyone, receiving contributions from security professionals and […]
